drydock-cli 3.0.68__tar.gz → 3.0.69__tar.gz

{drydock_cli-3.0.68/drydock_cli.egg-info → drydock_cli-3.0.69}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.68
+Version: 3.0.69
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0

drydock_cli-3.0.69/drydock/builtin_skills/stig-remediate.md

@@ -0,0 +1,16 @@
+---
+name: stig-remediate
+description: Generate a remediation script for an Open STIG finding
+---
+Generate a remediation script for an Open STIG finding. Input: $ARGS (a checklist
+path and a rule id, e.g. "sys.ckl V-230222").
+
+1. Call StigRule (the path + rule_id) to read the rule's Fix Text and Check Content.
+2. Determine the target OS — infer from the STIG/checklist name, or ask if unclear.
+3. Translate the prose Fix Text into an IDEMPOTENT, executable remediation script in
+   the requested format (default: Bash for Linux, PowerShell for Windows; Ansible if
+   asked). It must bring the system into compliance with the Check Content. Start it
+   with a comment header citing the rule id and what it fixes.
+4. Write the script to a file (Write tool), e.g. remediate_<rule>.sh, and tell the
+   user the path. Do NOT run it — the operator reviews and runs remediation.
+Only GENERATE the script; never execute remediation yourself.

{drydock_cli-3.0.68 → drydock_cli-3.0.69}/drydock/rmf_graph.py

@@ -118,6 +118,38 @@ def component_id(name: str) -> str:
     return f"component:{name.strip().lower()}"
 
 
+def stig_id(name: str) -> str:
+    return f"stig:{name.strip().lower()}"
+
+
+def rule_node(rid: str) -> str:
+    return f"stigrule:{rid.strip().lower()}"
+
+
+def ingest_checklist(g: "RmfGraph", checklist) -> dict:
+    """Add a parsed STIG Checklist to the typed graph: STIG + STIG-Rule nodes,
+    PART_OF (rule→stig), APPLIES_TO (stig→host), EVALUATES (rule→host). Returns
+    {rules, host}. The Control —SATISFIED_BY→ STIG-Rule link is asserted
+    separately (via GraphAdd 'satisfies') since it needs the CCI→control map."""
+    host = (checklist.asset.get("HOST_NAME") or checklist.asset.get("host_name") or "target")
+    hnode = component_id(host)
+    g.add_node(hnode, "Component", name=host, ip=checklist.asset.get("HOST_IP"))
+    sname = checklist.stig_name or "STIG"
+    snode = stig_id(sname)
+    g.add_node(snode, "STIG", name=sname, version=checklist.stig_version)
+    g.add_edge(snode, "APPLIES_TO", hnode)
+    for r in checklist.rules:
+        rid = r.rule_id or r.group_id
+        if not rid:
+            continue
+        rn = rule_node(rid)
+        g.add_node(rn, "STIGRule", rule_id=r.rule_id, group_id=r.group_id,
+                   severity=r.severity, status=r.status, cci=r.cci, title=r.title)
+        g.add_edge(rn, "PART_OF", snode)
+        g.add_edge(rn, "EVALUATES", hnode)
+    return {"rules": len(checklist.rules), "host": host}
+
+
 def build_from_catalog(catalog: dict, *, families: list[str] | None = None) -> RmfGraph:
     """Deterministically build Control + Objective nodes (and ASSESSES edges) from
     an OSCAL 800-53 catalog. The typed backbone the user's components/vulns attach to."""

{drydock_cli-3.0.68 → drydock_cli-3.0.69}/drydock/stig.py

@@ -43,6 +43,7 @@ class Rule:
     status: str              # canonical
     finding_details: str = ""
     comments: str = ""
+    cci: str = ""            # Control Correlation Identifier (maps up to a NIST control)
     _raw: Any = field(default=None, repr=False)  # ET element or dict, for edit-in-place
 
     def summary(self) -> str:
@@ -55,6 +56,8 @@ class Checklist:
     def __init__(self, fmt: str) -> None:
         self.fmt = fmt
         self.asset: dict = {}
+        self.stig_name: str = ""
+        self.stig_version: str = ""
         self.rules: list[Rule] = []
         self._tree: Any = None   # ckl: ElementTree
         self._data: Any = None   # cklb: dict
@@ -128,6 +131,9 @@ def parse_ckl(path: str | Path) -> Checklist:
     asset = root.find("ASSET")
     if asset is not None:
         cl.asset = {c.tag: (c.text or "") for c in asset}
+    info = {si.findtext("SID_NAME"): si.findtext("SID_DATA") for si in root.iter("SI_DATA")}
+    cl.stig_name = info.get("title") or info.get("stigid") or ""
+    cl.stig_version = info.get("version") or ""
     for vuln in root.iter("VULN"):
         data: dict[str, str] = {}
         for sd in vuln.findall("STIG_DATA"):
@@ -138,7 +144,7 @@ def parse_ckl(path: str | Path) -> Checklist:
             check_content=data.get("Check_Content", ""), fix_text=data.get("Fix_Text", ""),
             status=canonical_status(vuln.findtext("STATUS")),
             finding_details=vuln.findtext("FINDING_DETAILS") or "",
-            comments=vuln.findtext("COMMENTS") or "", _raw=vuln,
+            comments=vuln.findtext("COMMENTS") or "", cci=data.get("CCI_REF", ""), _raw=vuln,
         ))
     return cl
 
@@ -148,7 +154,10 @@ def parse_cklb(path: str | Path) -> Checklist:
     cl._data = json.loads(Path(path).read_text("utf-8"))
     cl.asset = cl._data.get("target_data", {}) or {}
     for stig in cl._data.get("stigs", []) or []:
+        cl.stig_name = cl.stig_name or stig.get("stig_name", stig.get("display_name", ""))
+        cl.stig_version = cl.stig_version or str(stig.get("version", ""))
         for rule in stig.get("rules", []) or []:
+            ccis = rule.get("ccis") or ([rule["cci"]] if rule.get("cci") else [])
             cl.rules.append(Rule(
                 group_id=rule.get("group_id", ""), rule_id=rule.get("rule_id", ""),
                 title=rule.get("rule_title", rule.get("group_title", "")),
@@ -156,7 +165,7 @@ def parse_cklb(path: str | Path) -> Checklist:
                 check_content=rule.get("check_content", ""), fix_text=rule.get("fix_text", ""),
                 status=canonical_status(rule.get("status")),
                 finding_details=rule.get("finding_details", ""),
-                comments=rule.get("comments", ""), _raw=rule,
+                comments=rule.get("comments", ""), cci=(ccis[0] if ccis else ""), _raw=rule,
             ))
     return cl
 

{drydock_cli-3.0.68 → drydock_cli-3.0.69}/drydock/tools/__init__.py

@@ -353,10 +353,11 @@ SCHEMAS = [
         "input_schema": {
             "type": "object",
             "properties": {
-                "op": {"type": "string", "description": "component | implements | resides_on | vulnerability"},
+                "op": {"type": "string", "description": "component | implements | resides_on | vulnerability | satisfies"},
                 "component": {"type": "string"},
-                "control": {"type": "string", "description": "control id, for op=implements"},
+                "control": {"type": "string", "description": "control id, for op=implements/satisfies"},
                 "parent": {"type": "string", "description": "parent component/boundary, for op=resides_on"},
+                "rule": {"type": "string", "description": "STIG rule id, for op=satisfies"},
                 "id": {"type": "string", "description": "vulnerability/STIG/CVE id, for op=vulnerability"},
                 "severity": {"type": "string"},
                 "os": {"type": "string"}, "ip": {"type": "string"}, "data_type": {"type": "string"},
@@ -1246,6 +1247,9 @@ def tool_graphquery(params: dict, config: dict) -> str:
         if objs:
             out.append("Assessment objectives:\n" + "\n".join(f"  - {o}" for o in objs))
         out.append("Implemented by: " + (", ".join(impl) if impl else "(no components recorded)"))
+        rules = [_gattrs(g, rn).get("rule_id", rn) for rn in g.neighbors(node, "SATISFIED_BY", direction="out")]
+        if rules:
+            out.append("Satisfied by STIG rules: " + ", ".join(rules))
         return "\n".join(out)
     if op == "family":
         ctrls = [_gattrs(g, c).get("control_id", c)
@@ -1301,8 +1305,16 @@ def tool_graphadd(params: dict, config: dict) -> str:
             g.add_node(rmf_graph.component_id(comp), "Component", name=comp)
             g.add_edge(vid, "AFFECTS", rmf_graph.component_id(comp))
         g.save(path); return f"Recorded vulnerability {params['id']}" + (f" affecting {comp}." if comp else ".")
-    return ("GraphAdd ops: component (name in `component`) | implements (`component`,`control`) "
-            "| resides_on (`component`,`parent`) | vulnerability (`id`, optional `component`,`severity`).")
+    if op == "satisfies" and params.get("control") and params.get("rule"):
+        cn, rn = rmf_graph.control_id(params["control"]), rmf_graph.rule_node(params["rule"])
+        if not g.get(cn):  # ref node if the catalog isn't bootstrapped
+            g.add_node(cn, "Control", control_id=params["control"].upper())
+        g.add_node(rn, "STIGRule", rule_id=params["rule"])
+        g.add_edge(cn, "SATISFIED_BY", rn)
+        g.save(path); return f"Recorded: {params['control'].upper()} SATISFIED_BY {params['rule']}."
+    return ("GraphAdd ops: component (`component`) | implements (`component`,`control`) | "
+            "resides_on (`component`,`parent`) | vulnerability (`id`, optional `component`) | "
+            "satisfies (`control`,`rule` — a STIG rule satisfies a NIST control).")
 
 
 def tool_websearch(params: dict, config: dict) -> str:

{drydock_cli-3.0.68 → drydock_cli-3.0.69}/drydock/tui/app.py

@@ -529,9 +529,28 @@ class DrydockApp(App):
                        "Assess it: /loop <n> /stig-assess <path>")
             return
         import os as _os
+        cwd = self.config.get("cwd") or "."
+        # /stig graph <path> — ingest the checklist into the RMF typed graph
+        if parts[0].lower() == "graph" and len(parts) > 1:
+            from drydock import rmf_graph
+            gp = parts[1] if _os.path.isabs(parts[1]) else _os.path.join(cwd, parts[1])
+            try:
+                cl = stig.load(gp)
+                g = rmf_graph.RmfGraph.load(rmf_graph.graph_path(cwd))
+                r = rmf_graph.ingest_checklist(g, cl)
+                g.save(rmf_graph.graph_path(cwd))
+            except Exception as e:  # noqa: BLE001
+                self._mount(ErrorMessage(f"could not graph checklist: {e}"))
+                return
+            self._info(
+                f"✓ Ingested {r['rules']} STIG rules for host '{r['host']}' into the "
+                f"RMF graph (STIG/STIG-Rule nodes, PART_OF/APPLIES_TO/EVALUATES). "
+                "Link rules to controls with GraphAdd satisfies; trace via GraphQuery."
+            )
+            return
         path = parts[0]
         if not _os.path.isabs(path):
-            path = _os.path.join(self.config.get("cwd") or ".", path)
+            path = _os.path.join(cwd, path)
         try:
             cl = stig.load(path)
         except Exception as e:  # noqa: BLE001

{drydock_cli-3.0.68 → drydock_cli-3.0.69/drydock_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: drydock-cli
-Version: 3.0.68
+Version: 3.0.69
 Summary: Drydock — a local, provider-agnostic terminal coding agent for local LLMs
 Author: Frank Bobe III
 License-Expression: Apache-2.0

{drydock_cli-3.0.68 → drydock_cli-3.0.69}/drydock_cli.egg-info/SOURCES.txt

@@ -30,6 +30,7 @@ drydock/builtin_skills/rmf-control.md
 drydock/builtin_skills/rmf-poam.md
 drydock/builtin_skills/rmf-review.md
 drydock/builtin_skills/stig-assess.md
+drydock/builtin_skills/stig-remediate.md
 drydock/tools/__init__.py
 drydock/tui/__init__.py
 drydock/tui/app.py
@@ -74,6 +75,7 @@ tests/test_providers_unreachable.py
 tests/test_read_index.py
 tests/test_rmf.py
 tests/test_rmf_graph.py
+tests/test_rmf_stig_graph.py
 tests/test_runaway_repetition.py
 tests/test_skills.py
 tests/test_stig.py

{drydock_cli-3.0.68 → drydock_cli-3.0.69}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 # PyPI distribution name is drydock-cli (the established install name, continued
 # from the retired v2 fork); the import package + CLI command stay `drydock`.
 name = "drydock-cli"
-version = "3.0.68"
+version = "3.0.69"
 description = "Drydock — a local, provider-agnostic terminal coding agent for local LLMs"
 readme = "README.md"
 requires-python = ">=3.11"

drydock_cli-3.0.69/tests/test_rmf_stig_graph.py

@@ -0,0 +1,39 @@
+"""RMF Phase 2 STIG ontology — ingest a checklist into the typed graph and
+trace Control <-SATISFIED_BY-> STIG-Rule."""
+from __future__ import annotations
+
+from drydock import stig, rmf_graph
+from drydock.tools import tool_graphadd, tool_graphquery
+
+_CKL = ('<?xml version="1.0"?><CHECKLIST><ASSET><HOST_NAME>web01</HOST_NAME></ASSET>'
+        '<STIGS><iSTIG><STIG_INFO><SI_DATA><SID_NAME>title</SID_NAME><SID_DATA>RHEL 9 STIG</SID_DATA></SI_DATA></STIG_INFO>'
+        '<VULN><STIG_DATA><VULN_ATTRIBUTE>Vuln_Num</VULN_ATTRIBUTE><ATTRIBUTE_DATA>V-1</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>Rule_ID</VULN_ATTRIBUTE><ATTRIBUTE_DATA>SV-1r1</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STIG_DATA><VULN_ATTRIBUTE>CCI_REF</VULN_ATTRIBUTE><ATTRIBUTE_DATA>CCI-000366</ATTRIBUTE_DATA></STIG_DATA>'
+        '<STATUS>Open</STATUS></VULN></iSTIG></STIGS></CHECKLIST>')
+
+
+def test_parse_captures_stig_info_and_cci(tmp_path):
+    p = tmp_path / "s.ckl"; p.write_text(_CKL)
+    cl = stig.load(p)
+    assert cl.stig_name == "RHEL 9 STIG" and cl.rules[0].cci == "CCI-000366"
+
+
+def test_ingest_checklist_builds_typed_nodes(tmp_path):
+    (tmp_path / "s.ckl").write_text(_CKL)
+    cl = stig.load(tmp_path / "s.ckl")
+    g = rmf_graph.RmfGraph()
+    r = rmf_graph.ingest_checklist(g, cl)
+    assert r["rules"] == 1 and r["host"] == "web01"
+    rn = rmf_graph.rule_node("SV-1r1")
+    assert g.get(rn)["type"] == "STIGRule"
+    assert rmf_graph.stig_id("RHEL 9 STIG") in g.neighbors(rn, "PART_OF")
+    assert rmf_graph.component_id("web01") in g.neighbors(rn, "EVALUATES")
+
+
+def test_satisfies_links_control_to_rule(tmp_path):
+    rmf_graph.RmfGraph().save(rmf_graph.graph_path(str(tmp_path)))
+    cfg = {"cwd": str(tmp_path)}
+    assert "SATISFIED_BY" in tool_graphadd({"op": "satisfies", "control": "CM-6", "rule": "SV-1r1"}, cfg)
+    out = tool_graphquery({"op": "control", "id": "CM-6"}, cfg)
+    assert "Satisfied by STIG rules" in out and "SV-1r1" in out

{drydock_cli-3.0.68 → drydock_cli-3.0.69}/tests/test_skills.py

@@ -55,7 +55,7 @@ def test_empty_body_skipped(tmp_path):
 def test_no_user_or_project_skills_yields_only_builtins(tmp_path):
     # With no user/project skills, only the bundled built-ins (RMF) are present.
     loaded = skills.load_skills(str(tmp_path))
-    assert set(loaded) == {"rmf-control", "rmf-categorize", "rmf-review", "rmf-poam", "stig-assess"}
+    assert set(loaded) == {"rmf-control", "rmf-categorize", "rmf-review", "rmf-poam", "stig-assess", "stig-remediate"}
 
 
 def test_create_skill_user_scope(tmp_path, monkeypatch):